How do you communicate during a security incident?

Direct answer

What a strong answer covers

How it works

During a security incident, communication is a control: it prevents responders from being pulled in ten directions, keeps leadership from making decisions on rumours, and protects the organisation legally. One incident lead owns the message. Channels are verified and out of band if the primary ones may be compromised. Every update separates what is confirmed from what is suspected, and gives the next update time. Responders get technical detail; executives get impact, decisions needed, and timelines; legal and privacy get facts needed for notification decisions; customers get accurate, plain statements approved by legal without speculation or sensitive detail. Decisions and their timing are recorded as they happen.

Example

When a credential leak was suspected, the incident lead set a 30-minute update cadence in a dedicated channel, with the first message stating three confirmed facts, two open questions, and the next update time. Executives received a one-paragraph summary with the decision required about customer notification; legal received the access logs; the customer statement went out twelve hours later, after the scope was confirmed, saying what happened, what was done, and what customers should do.

Common mistakes

• Speculating about cause or scope in a written update that later proves wrong.
• Letting several people send conflicting messages to customers.
• Sharing indicators and exploit details in a broad channel where they can leak.

A useful answer structure

Answer from your own work.

Do not memorise a script: use only examples you can explain honestly in follow-up questions.